Splunk btool vs literal search differ

koshyk — Wed, 30 Sep 2020 01:45:20 GMT

We are trying to override a field in Splunk_TA_nix.
Rather than working on Splunk_TA_nix (local), we have a separate add-on for our company's customized settings. The add-on have higher order in ASCII ( MY_nix_addon )But when it comes to eventtypes.conf, somehow the override is NOT working.

Btool output.

/opt/splunk/etc/apps/MY_nix_addon/local/eventtypes.conf            [sshd_authentication]
/opt/splunk/etc/system/default/eventtypes.conf                          color = 
/opt/splunk/etc/system/default/eventtypes.conf                          description = 
/opt/splunk/etc/system/default/eventtypes.conf                          disabled = 0
/opt/splunk/etc/system/default/eventtypes.conf                          priority = 1
/opt/splunk/etc/apps/MY_nix_addon/local/eventtypes.conf            search = (index=idx_os) sshd (((Accepted OR Failed OR failure OR "Invalid user" OR "authentication error") from) OR "Authorized to" OR "Authentication tried" OR "Login restricted")

But literal search still goes back to the one in /opt/splunk/etc/apps/Splunk_TA_nix/local/eventtypes.conf entry and is not restricted based on index. The actual search happens but on original Splunk_TA_nix

(NOT sourcetype=stash) NOT sourcetype=ossec sshd (((Accepted OR Failed OR failure OR "Invalid user" OR "authentication error") from) OR "Authorized to" OR "Authentication tried" OR "Login restricted")

The rest of the props.conf, transforms.conf works perfectly and if it shows in btool, the outcome is similar and we have been doing this for years. Somehow the eventtypes.conf btool vs literal search differs !! (I've restarted multiple times). Running the search by copy-paste works perfectly too.

any idea about this issue? Any other tricky things done by Splunk_TA_nix ?

Update:
in the WebUI, rather than merging it into single eventtype, it shows as two eventtypes !!

topic Splunk btool vs literal search differ in Monitoring Splunk

Splunk btool vs literal search differ